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Abstract — NASA’s long-range goal is focused upon human 
exploration of Mars. Missions to Mars will require campaigns 
of multiple launches to assemble Mars Transfer Vehicles in 
Earth orbit. Launch campaigns are subject to delays, launch 
vehicles can fail to place their payloads into the required orbit, 
and spacecraft may fail during the assembly process or while 
loitering prior to the Trans-Mars Injection (TMI) burn. 
Additionally, missions to Mars have constrained departure 
windows lasting approximately sixty days that repeat 
approximately every two years. Ensuring high reliability of 
launching and assembling all required elements in time to 
support the TMI window will be a key enabler to mission 
success. This paper describes an integrated methodology for 
analyzing and improving the reliability of the launch and 
assembly campaign phase. A discrete event simulation involves 
several pertinent risk factors including, but not limited to: 
manufacturing completion; transportation; ground processing; 
launch countdown; ascent; rendezvous and docking, assembly, 
and orbital operations leading up to TMI. The model 
accommodates varying numbers of launches, including the 
potential for spare launches. Having a spare launch capability 
provides significant improvement to mission success. 
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1. Introduction 

NASA has been analyzing strategies for human exploration 
of Mars for many years. In 2009, NASA published “Human 
Exploration of Mars: Design Reference Architecture 5.0” 
(DRA 5.0) [1] along with a detailed technical addendum [2] 
that describe an operations concept for the first human 
missions to Mars. The Mars DRA 5.0 documents represent 
U.S. Government work not protected by U.S. copyright 


the most comprehensive study for human exploration of 
Mars published to date and now serve as the point of 
departure for continued studies. 

There have been several key strategic changes since the 
2009 timeframe that are being factored into current 
analyses. Changes to NASA’s human exploration program 
since 2009 include: the cancellation of the Ares I launch 
vehicle; the replacement of the planned Ares V launch 
vehicle with the Space Launch System (SLS); and changes 
to the ground processing architecture. These changes have 
significant ramifications to the launch and assembly phase 
of missions to Mars. 

Remaining unchanged is the complex nature of Mars 
exploration, especially the reliability of launching and 
assembling all the required elements in a timely manner to 
support the planned departure window. To assist in the 
reliability analysis, NASA has been developing an 
integrated methodology to analyze launch and assembly 
reliability. This work builds upon previous analyses 
performed for the Space Shuttle and International Space 
Station Programs [3, 4, 5], the Constellation Program [6, 7], 
the Review of Human Space Flight Plans Committee [8], 
and studies performed in 2011 on launch and assembly 
reliability for human exploration missions to near-Earth 
asteroids [9]. 

The integrated launch and assembly reliability methodology 
starts with flight hardware manufacturing and ends with 
final departure of a Mars Transfer Vehicle (MTV) or set of 
MTVs from the Earth assembly orbit. Pertinent risk factors 
are accounted for within a stochastic discrete event 
simulation for each Design Reference Mission (DRM). 

This paper presents illustrative results from analysis of the 
launch and assembly campaigns described in DRA 5.0 
(modified to reflect NASA’s programmatic changes since 
that time, as described above) and suggests ways in which 
reliability can be significantly improved. Section 2 
introduces the complexities and risks inherent to launch and 
assembly of Mars missions. Section 3 provides a brief 
overview of the concept of operations considered by DRA 
5.0. The fourth section describes the simulation models. 
Section 5 lists the cases analyzed followed by the results in 
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Section 6. Conclusions and forward work are addressed in 
Section 7. 

2. Complexity and Risks of Launch and 
Assembly 

The DRA 5.0 concept for human exploration of Mars 
requires multiple launches to assemble multiple Mars 
Transfer Vehicles (MTVs) in Earth orbit. The process of 
completing all of the required launches and assembly 
activities will be complex and require significant time. The 
launch and assembly activities need to be planned with 
sufficient margin such that they can be reliably completed 
prior to the desired departure window. If the window of 
opportunity for MTV departure — which is assumed to be 
open for approximately 60 days — is missed, spacecraft 
already in Earth orbit will likely not be mission capable 26 
months later, at the next departure opportunity. 

Key Constraints 

Human exploration missions to Mars have several 
constraints that will directly impact the launch and assembly 
reliability. Constraints in addition to the limited departure 
opportunities include: the reliability of the Space Launch 
System (SLS), the amount of cargo up-mass and volume 
provided by the SLS; the reliability and on-orbit lifetime 
capacity of the elements being placed in Earth orbit; and the 
ground processing architecture and workforce for preparing 
launch vehicles and their respective payload elements. 

Minimum energy departure opportunities to Mars are 
available from an assumed low Earth orbit (LEO) assembly 
orbit for an assumed period of 60 days every 26 months. 
The actual duration of the departure window may be 
different depending upon the delta velocity capacity of 
future MTVs. 

NASA is presently planning to build a SLS capable of 
placing 105 metric tons (t) into LEO and may ultimately 
increase this capacity to 130 t. The mass and volumetric 
capacity of the SLS will influence how many launches need 
to be conducted for any given scenario. Fewer launches 
should be better than more launches, however differences in 
reliability are also considered in the analysis methodology 
for optimizing the overall probability of launch and 
assembly success. 

During the time that Mars DRA 5.0 was developed, NASA 
was planning on a robust ground processing architecture 
that made use of multiple launch vehicle integration high 
bays in the Vehicle Assembly Building (VAB) at the 
Kennedy Space Center along with multiple mobile 
launchers and two launch pads. Since that time, NASA has 
scaled back the plans such that only a “single-string” 
capacity is being put in place. This means that there will 
only be one mobile launcher, one launch pad and one launch 
vehicle integration high bay. This concept essentially 
precludes parallel processing of multiple launch vehicles. 


In DRA 5.0, launches were planned to occur on 30 -day 
centers. The planned single string architecture, along with 
planned processing on a 5 day - two 8-hour shifts per day 
(5x2), precludes this frequency of launches. Analysis point 
of departure begins with the planned single string 
architecture with 5x2 processing but also utilizes alternative 
assumptions, e.g., a dual string architecture with 5x3 
processing (5 day, 24 hour processing). 

Launch reliability could be improved by adding time margin 
to the launch and assembly schedule. If launches for all 
elements and the crew were planned to occur earlier, 
relative to the destination departure window, the probability 
of completing all of the required activities in time to meet 
the departure opportunity increases significantly. DRA 5.0 
acknowledged this fact by concluding that approximately 
90-180 days of margin would be inserted in the launch 
campaign plan between the last launch of the campaign and 
the opening of the Earth departure window. 

However, given the complexity of the launch and assembly 
campaign and the many delay risks, it is not clear that 90- 
180 days will be adequate. Unfortunately, there are also 
additional constraints that limit the ability to add time 
margin to the launch and assembly schedule. 

Increasing the amount of time that elements of the MTVs 
loiter in the assembly orbit adds additional risk to the 
assembly process. The probability of system failures within 
the elements or of micrometeorite and orbital debris 
(MMOD) strikes increase as loiter time is extended. In 
addition, adding margin will increase the total lifetime of 
elements. Leaving elements in space for longer durations 
prior to departure could increase the risk of failure later in 
the mission, during more critical stages. 

Crew time in space is also a major issue with adding margin 
to the launch and assembly process. Because the crew 
launch is typically the last launch in the sequence, adding 
margin between that event and the departure window will 
have the greatest benefit on reliability. However, there are 
significant issues to adding to the amount of time that crew 
must spend in space. The expected Mars mission time is 
approximately 2.5 years and already presents challenges to 
the crew. Requiring the crew to loiter at the assembly point 
prior to departure will only increase those risks. Additional 
time loitering at the assembly location also increases the risk 
that a crew health event will occur, requiring an abort back 
to Earth and thus ending the mission. 

In order to commit to a human mission to Mars, all of these 
constraints as well as the many risks identified below will 
have to be addressed such that there is an acceptably high 
level of confidence that the launch and assembly will be 
successful. 
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Types of Risks 

The types of risks involved in the launch and assembly of 
the MTVs can be divided into two major categories: Pre- 
Launch Risks and Post-Launch Risks. 

Pre-Launch Risks are those that occur prior to ignition of 
the main engines of the launch vehicle for any launch that 
supports the mission. These risks involve all of the activities 
required to manufacture, deliver, assemble, and prepare 
each vehicle for launch. 

Manufacturing Reliability — All elements for the Mars 
mission, including MTVs elements, launch vehicles, and 
propulsive elements must be manufactured, tested, and 
delivered to the space center. Delays in these activities 
would delay the launch and assembly schedule. The risk of 
manufacturing related delays was quantified using Space 
Shuttle historical data 

Processing Reliability — Processing capabilities at the space 
center are limited by facilities and personnel constraints. 
These constraints dictate the planned launch schedule for 
elements. Delays in completing element processing and 
launch vehicle assembly could significantly impact the 
launch and assembly schedule. 

Launch Reliability — The launch of spacecraft in Earth orbit 
is notoriously unreliable. Historically, the success rate for 
launching a spacecraft on any specific attempt has been a 
little above 50%. The Space Shuttle launch probability 
throughout its history was 0.53. Even the relatively simple 
Delta II only had a 0.56 launch probability for launches 
between 1989 and 2001 [10]. While many delays are 
weather related or involve minor problems that can be 
quickly corrected, either of which allow the next attempt to 
occur quickly, there are often failures on the launch pad that 
require long periods of time to correct. In addition, because 
of limited launch windows required to conduct on-orbit 
rendezvous, even small delays may cause launch to be 
delayed for a minimum of 24 hours. Conducting multiple 
launches to support a Mars mission increases the exposure 
to launch delays, potentially reducing the overall probability 
of meeting the departure window. 

Post-Launch Risks are those that occur after the ignition of 
the main engines of the launch vehicle and involve all of the 
activities required to position and assemble elements, 
deliver the crew to the MTVs, and prepare for departure. 

Launch Failure — The launch and ascent of a vehicle into 
LEO is typically one of the most risky phases in any space 
mission. Conducting multiple launches into LEO to support 
the mission will increase the overall probability of launch 
failure in at least one of the launches. 

Element Failure on Orbit — As elements loiter in LEO or at 
some other potential spacecraft assembly point, there are 
multiple types of failure that can occur that could endanger 
the mission. Potential failures include unrepairable system 


failures within the spacecraft elements, MMOD strikes on 
spacecraft elements, and damage due to radiation exposure. 
These risks increase as loiter period increases. 

Propulsive Failure — Subsequent to launch into LEO, many 
missions will require elements to be relocated to the 
spacecraft assembly location. This will require some form of 
in-space propulsion. Failure or delays with these events 
could result in failure of the overall mission. Elements also 
require on-going station keeping. Failure of the Reaction 
Control System (RCS) could also result in mission failure. 

Assembly /Docking Failure — Assembly of the MTVs will 
require that multiple independently launched elements be 
aggregated in space. That will require some form of 
rendezvous and docking of those elements. Because the 
crew will likely not be present when most of the assembly 
events occur, the assembly will involve automated 
rendezvous and docking (ARD) events. Historically, ARD 
has proved troublesome for in-space vehicles and a number 
of failures have occurred. Failure in the assembly of the 
MTVs could result in failure of the overall mission. 

Crew Issues — Problems with the crew, including health 
issues and injury, can occur as the crew travels to the 
assembly location, and/or loiters in the MTVs prior to 
departure. Serious crew issues could require abort back to 
Earth and abandonment of the mission. 

Departure Burn Failures — A primary purpose of the Mars 
Transfer Vehicle is to perform the propulsion burn required 
to escape Earth orbit. The potential for failure at this point is 
a function of the reliability of the propulsion system. That 
reliability risk needs to take into consideration that the 
propulsion system will have been loitering in Earth orbit for 
an extended duration of time, potentially a year or more. 
Today’s upper stages used to propel spacecraft beyond 
Earth orbit are typically fired within minutes or hours of 
launch. Departure bum failures, while resulting in a loss of 
mission, would still allow the crew to abort back to Earth. 

The constraints and risks described herein require that 
missions be designed in a way that the total achieved launch 
and assembly reliability will result in an acceptable 
probability of mission success. The reliability and the 
timing of launch and assembly events must be carefully 
evaluated in order to identify and mitigate those risks. 

There is a fundamental tension between adding margin to 
the launch schedule and the amount of in-space risk 
exposure. A balance must be achieved between these factors 
in order to develop an acceptable level of overall reliability. 

This evaluation should occur in conjunction with the 
analysis and design of the launch systems and MTV 
elements. Because most of these systems and many of the 
technologies that are incorporated into them do not yet exist, 
it is still possible to influence capabilities and system 
reliabilities in order to achieve a reasonable overall 
reliability. 
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3. Concept of Operation for Mars Human 
Exploration (DRA 5.0) 

The basic concept of operations described in Mars DRA 5.0 
was to send three Mars Transfer Vehicles (MTVs) to Mars 
as shown in Figure 1 [1]. Each of the three MTVs would 
propel one of the three major payload elements required at 
Mars to conduct the mission. These were: (1) a Mars surface 
habitat (the SHAB) that the crew uses to descend to the 
Mars surface and where they live in and work from during 
their stay on Mars; (2) a Mars descent / ascent vehicle (the 
MDAV) that is used to descend exploration gear to the Mars 
surface and then at the conclusion of the Mars surface 
mission to ascend the crew back to Mars orbit; and (3) the 
deep space habitat (the HAB) that the crew would live in 
during their transit from Earth orbit to Mars orbit and back. 

Mars DRA 5.0 considered two propulsion concepts for the 
MTVs, Nuclear Thermal Rocket (NTR) or Chemical. It also 
considered two alternatives for getting the three MTV 
payloads to Mars, either “all-up” or “pre-deployed.” In the 
example depicted in Figure 1 the SHAB and MDAV were 
“pre-deployed” in that they were sent to Mars 26 months 
prior to departure of the crew from Earth orbit. Other 


concepts known as “all-up” sent all three MTVs to Mars 
during one Mars departure window opportunity. 

For DRA 5.0 the total amount of up -mass required to LEO 
was dependent upon: (1) the type of propulsion used by the 
MTV with NTR requiring less mass than chemical 
propulsion and; (2) the strategy for going to Mars, i.e., “pre- 
deployed” versus “all-up”, which requires more mass. 
According to DRA 5.0 documentation, the pre-deployed 
missions require less mass because the cargo missions are 
sent on more energy efficient trajectories thus requiring less 
propellant for the same surface system mass. Figure 2 [2] 
shows the DRA 5.0 assessment of up-mass required to LEO 
for the various alternatives. 

Using the information from Mars DRA 5.0 depicted in 
Figure 2 and the capacity of the SLS, either 105 t or 130 t, 
Table 1 was created to identify the number of SLS launches 
required for the representative scenarios analyzed. There 
was no optimization of elements and launch vehicles 
performed to align the number of launches required. The 
number of launches is an approximate representation and 
further in-depth analysis would be required to verify these 
numbers and assumptions. 
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Figure 1 - Example Concept of Operations from Mars DRA 5.0 - “Pre-deployed” & NTR 
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Figure 2 - Up-Mass to LEO from Mars DRA 5.0 
Table 1. Assessment for Number of SLS Launches Required per MTV 


SLS Up-Mass Capacity 
MTV Propuls ion Type 

105 1 Capable SLS 

NTR Chemical 


130 1 Capable SLS 

NTR Chemical 

Deployement Strategy 

Pre-Deploy All-Up Pre-Deploy All-Up 


Pre -Deploy All-Up Pre-Deploy All-Up 

MTV-1 

Payload 

(Mars Descent / 
Ascent Vehicle) 



Chem. Prop. 
Module 

Chem. Prop. 
Module 





Chem. Prop. 
Module 

Propellant Drop 
Tank 

Propellant Drop 
Tank 

Chem. Prop. 
Module 

Chem. Prop. 
Module 



Propellant Drop 
Tank 

Chem. Prop. 
Module 

Chem. Prop. 
Module 

NTR 

Prop .Module 

NTR Prop. 
Module 

Chem. Prop. 
Module 

Chem. Prop. 
Module 


NTR 

Prop .Module 

NTR Prop. 
Module 

Chem. Prop. 
Module 

Chem. Prop. 
Module 

MDAV 

MDAV 

MDAV 

MDAV 


MDAV 

MDAV 

MDAV 

MDAV 

MTV-2 

Payload 

(Surface Habitat) 


Propellant Drop 
Tank 

Chem. Prop. 
Module 

Chem. Prop. 
Module 




Chem. Prop. 
Module 

Propellant Drop 
Tank 

Propellant Drop 
Tank 

Chem. Prop. 
Module 

Chem. Prop. 
Module 


Propellant Drop 
Tank 

Propellant Drop 
Tank 

Chem. Prop. 
Module 

Chem. Prop. 
Module 

NTR 

Prop .Module 

NTR Prop. 
Module 

Chem. Prop. 
Module 

Chem. Prop. 
Module 


NTR 

Prop .Module 

NTR Prop. 
Module 

Chem. Prop. 
Module 

Chem. Prop. 
Module 

SHAB 

SHAB 

SHAB 

SHAB 


SHAB 

SHAB 

SHAB 

SHAB 

MTV-3 

Payload 

(Deep Space Habitat) 
and Crew-Orion 
(always on 105 mT SLS 



Chem. Prop. 
Module 

Chem. Prop. 
Module 



Chem. Prop. 
Module 


Propellant Drop 
Tank 

Propellant Drop 
Tank 

Chem. Prop. 
Module 

Chem. Prop. 
Module 


Propellant Drop 
Tank 

Propellant Drop 
Tank 

Chem. Prop. 
Module 

Chem. Prop. 
Module 

NTR 

Prop .Module 

NTR Prop. 
Module 

Chem. Prop. 
Module 

Chem. Prop. 
Module 


NTR 

Prop .Module 

NTR Prop. 
Module 

Chem. Prop. 
Module 

Chem. Prop. 
Module 

HAB 

HAB 

HAB 

HAB 


HAB 

HAB 

HAB 

HAB 

Crew- 

Orion 

Crew- 

Orion 

Crew- 

Orion 

Crew- 

Orion 


Crew- 

Orion 

Crew- 

Orion 

Crew- 

Orion 

Crew- 

Orion 

Total SLS Launches 

10 11 13 13 


9 10 11 12 

Launches per Departure 
Window Opportunity 

NTR 

Pre-Deploy 

105 1 Capable SLS 
NTR Chemical Pre- 

All-Up Deploy 

Chemical 

All-Up 


NTR 

Pre -Deploy 

130 1 Capable SLS 
NTR Chemical Pre- 

All-Up Deploy 

Chemical 

All-Up 

MTV-1 & 2 Pre-Deploy 

6 


8 



5 


6 


MTV-3 (if 1&2 predeployed) 

4 


5 



4 


5 


MTVs 1,2,& 3 "all-up" 


11 


13 



10 


12 


5 














4. Description of Simulation Model 

A stochastic discrete event simulation model was created 
using Rockwell Automation’s Arena simulation software 
[11]. Figure 3 provides a high level overview of the model, 
which includes linkages to Excel files for inputs and results. 
The model logic includes entity routing to reflect all of the 
major processes and operations in the launch and assembly 
sequence from manufacturing completion through readiness 


and performance of the Earth departure burn, as shown in 
Figure 4. 

The simulation is run for 1,000 replications, with each 
replication representing one possible manifestation of the 
launch and assembly sequence. The only difference between 
the replications is the random numbers used to drive the 
various risk models. 



Figure 3 - Model Overview 



Figure 4 - Flight Hardware Elements Entity Routing Within Model 
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Overview of Risk Models 

Manufacturing & Launch Campaign Risks — Delay risks 
through the start of launch countdown have been previously 
described in detail [9] and were used again for this analysis. 
The other risk elements of the model are described below. 

Launch Countdown Delay Risk — The launch countdown 
delay risk models used for this analysis are based primarily 
upon Space Shuttle (a.k.a. STS) historical data coupled with 
the expected differences between the Space Shuttle and 
SLS. Figure 5 shows the actual cumulative launch 
distribution function created from the launch countdown 
history of 135 Space Shuttle missions along with the 
projected launch countdown delay distribution functions for 
the 105 t SLS (both crew and cargo variants) and the 130 t 
cargo SLS. 

The projected distributions lie below the STS distribution 
for a number of reasons, including: 4 versus 3 Space Shuttle 
Main Engine (SSME) class engines; the ground 
architecture’s limited capacity, relative to the capacity 
during the STS program, to perform consecutive propellant 
loadings of the SLS; the ground architecture’s clean pad 
concept which limits the ability to perform troubleshooting 
at the launch pad and increases the likelihood of needing to 
roll-back to the VAB in the event of a technical scrub; and 
in the case of crewed launches, the need to consider the sea 
state conditions in the Orion ocean abort zones. 

These projections are subject to a fair amount of uncertainty 
today, and to change in the future, given that the SLS, 
Orion, and payloads to be flown have not yet been 


developed, let alone established a launch history. For the 
time being they are believed to represent a reasonable 
estimate. 

Ascent Loss of Mission Risk — For previous analysis, a range 
of values from 4.17E-3 to 3.0E-2 was used for the potential 
reliability of the SLS vehicle during ascent [9]. However, 
for this analysis, illustrative point estimates are used. Using 
historical information from the Space Shuttle experience (1 
Solid Rocket Booster (SRB) failure and 1 SSME shutdown 
in 135 missions), a value of 1.716E-2 was derived as shown 
in Table 2 for the ascent reliability of the 105 t SLS. This 
estimate assumes that the vehicle uses twin SRBs similar to 
the STS and has 4 SSME class engines on the core stage as 
opposed to the 3 SSMEs used by the Space Shuttle. 

For the 130 t SLS, twin liquid boosters with RD-180 class 
engines, 4 SSME class engines on the core stage, and a 
liquid hydrogen/liquid oxygen (LH 2 -L0 2 ) upper stage with 
1 or 2 J2-X engines are assumed. For the 4 SSME class 
engines on the cores stage, the estimate of 9.84E-3 is used 
as shown in Table 2 for P L om for that portion of the vehicle. 

The Apollo and Skylab J-2 experience and Centaur upper 
stage reliability provide useful analogs for estimating upper 
stage reliability on the 130 t SLS. The Apollo and Skylab 
flight history for the J-2 consisted of 88 engines being flown 
with 1 engine shutdown event. This suggests a per engine 
failure rate of approximately 1.14E-2. The Centaur upper 
stage has a similar failure rate of approximately 1.2E-2 [13]. 
The analysis presented in this paper uses the 1.2E-2 value 
for the future SLS upper stage. 


Launch T-O Cumulative Distribution Functions 

Relative to initial planned T-0 at start of launch countdown 



Figure 5 - Launch Countdown Delay Risk Models 


7 


The Atlas V vehicle provides a potential analog for the 
reliability of the twin liquid booster. A study by the 
Futron Corporation places the expected Atlas V (401 
variant) failure rate due to propulsion and separation 
events at 1.78E-2 [14]. However, this value includes 
Centaur Upper Stage risk. Subtracting out the 1.2E-2 
Centaur contribution yields a value of 5.87E-3 for the 
failure rate of the core stage of the Atlas V. This becomes 
the analog estimate for the SLS side stage failure rate. 
Since the SLS has twin side stages, the effective failure 
rate for the two side stages is 1.17E-2. 


Table 2. 105 t SLS Loss of Mission (LOM) Risk 
Derivation 



Space Shuttle 
SRBs (2) 

Space Shuttle 
SSME (3) 

Flights 

135 

135 

Units per Flight 

2 
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1 
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4.932E-03 

3 


7.389E-03 

4 

9.840E-03 

5 

1.228E-02 





105 1 SLS 

Ascent P L om 

1.716E-02 

A s c ent Re liab ility 

0.9828 


Combining the side stage risk of 1.17E-2 and the core 
stage engine risk of 9.84E-3 produces a value of 2.143E-2 
for the 130 t SLS first stage (twin side stages plus core 
stage). Adding the upper stage risk of 1.2E-2 yields a 
combined ascent Plom value of 3.317E-2 for the 130 t 
SLS. 

If NASA were to develop a 130 t SLS with liquid rocket 
booster (LRB) for lifting cargo, it is likely that the smaller 
105 t vehicle used to launch the crew would be modified 
to rely on liquid side boosters as well. Note that 
maintaining both an SRB and LRB capability in the future 
would likely prove to be too expensive. Consequently, 
when launch campaigns are analyzed in which the 130 t 
vehicle is being used to launch cargo, it is assumed that 
the 105 t utilizes the same LRBs. In that case the ascent 
reliability of the 105 t SLS with LRB is 2.143E-2. 

Automated Rendezvous & Docking Risk — The operations 
concept relies upon automated rendezvous and docking 
(ARD) for the various non-crewed elements making up 
the MTVs. 


In previous studies, a range of values were used for the 
probability of ARD failure - from 1.5E-2 (optimistic) to 
1.0E-1 (conservative). The Progress automated docking 
system has the most experience and is considered 
sufficiently reliable to be used on the ISS. However, a 
review of 45 automated Progress ISS docking missions 
found that in 7 of these missions the automated docking 
system failed to such an extent that the crew on board the 
ISS had to take over and conduct a manual rendezvous 
and docking [12]. This indicates a failure rate of 
approximately 1.6E-1. There was also an instance where a 
resupply ship unintentionally impacted the Mir space 
station during a re-docking maneuver. 

To narrow the scope of this analysis cycle, a point 
estimate documented in the report of the Exploration 
Systems Architecture Study (ESAS) was used. That study 
estimated the probability of failure for automated docking 
at 1 in 97 or 1.03E-2 [15]. 

The probability of a rendezvous and dock failure for the 
crew-assisted Orion docking with the MTV is much lower 
than that for the automated procedure. The presence of the 
crew to take over in real time mitigates much of the risk. 
Additionally, the historical data for Space Shuttle and 
Soyuz crew docking with the Mir and ISS indicate a high 
level of reliability. The ESAS report estimated the 
docking failure rate at 1 in 230 or 4.35E-3 [15]. 

System Reliability and MMOD Risks — Once established 
in orbit, an entity representing each major element of the 
MTVs is sent to a system reliability model and an MMOD 
risk model where there is a daily chance of a system 
failure or MMOD damage resulting in loss of mission. 
These daily risks of system failure or MMOD induced 
loss of mission for each MTV element in orbit continues 
until trans-Mars injection burn for that MTV. 

Since these spacecraft have not been designed, built or 
operated yet, it is difficult to develop accurate risk 
models. In previous studies, it has been estimated that the 
per element MMOD risk for elements in LEO is between 
5.1E-6 and 5.1E-5 per day. The wide range in values 
reflects difference in element size and design, particularly 
in the amount of MMOD protection incorporated in the 
element, and differences in orbit and orientation. For this 
study a value of 1.0E-5 per MTV element per day was 
used. This represents a somewhat optimistic value, 
reflecting the assumption that significant MMOD 
protection would be incorporated into MTV elements. 

Additional factors were considered while estimating the 
system reliability risk models for the various MTV 
elements launched into orbit. These included the 
complexity of the element, whether or not the ISS 
provided a reasonable analog, and the absence during 
most of the MTV assembly period of a crew to identify 
problems and effect repairs to preclude loss of mission. 
The chosen values shown in Table 3 are subjective. 






Table 4. In-Flight Risk Settings 


Table 3. System Failure Rates 
(Per Day in LEO) Used in This Study 


MTV Elements 

Plom 

HAB 

1.00E-04 

SHAB 

1.00E-04 

MDAV 

1.00E-05 

Orion 

1.00E-05 

Propulsion 

Elements 

2.50E-06 


Crew Medical Risk — Once the crew is launched into 
Earth orbit and up until the departure burn for Mars, there 
is the potential that a crew medical event will prompt a 
decision to return the ailing crew member to Earth. This 
scenario results in a loss of mission. 

Inputs for the crew health risk model are based upon work 
performed by NASA’s Integrated Medical Model (IMM) 
project team [16]. The IMM is being developed to 
respond to a significant need identified in NASA’s 
Human Research Roadmap [17] to quantify likelihood 
and consequence of medical conditions that could occur 
in spaceflight [18]. 

Based upon inputs from the IMM community, daily rates 
of 7.19E-5, 9.72E-5 and 2.05E-4 LOM health events per 
astronaut-day respectively for the optimistic, neutral, and 
conservative risk settings were previously used [9]. To 
reduce the number of simulation runs for this study, the 
neutral value was assumed for all cases. The planned date 
for launching the crew relative to the opening of the 
departure window was also held constant. 

Departure Burn Risk — The culmination of the launch and 
assembly campaign is the trans-Mars injection burn for 
each MTV. This is essentially another upper stage burn so 
the Centaur failure probability value, 1.2E-2 that was 
previously discussed, was assumed. Note that, since there 
is very little data available regarding NTR reliability, the 
same value was assumed for both the Chemical and NTR 
options. There may actually be significant reliability 
differences between these two propulsion types. 

Summary of Risk Factors 

A summary of the post-launch risk factor settings is 
shown in Table 4. 


Risk Factors Plom 


Ascent 

105 1 SLS 

1.716E-02 

105 1 SLS with LRBs 

2. 142E-02 

130 1 First Stage 

2. 142E-02 

130 1 Upper Stage 

1.200E-02 

Rendezvous, 
Proximity 
Operations & 
Docking/ 
Connection 

Automated 
(Between MTV 
Elements) 

1.030E-02 

Crew Directed 
(Orion to MTV) 

4.350E-03 

System 
Reliability 
Per Element 
Per Day 
On Orbit 

HAB 

1.000E-04 

SHAB 

1.000E-04 

MDAV 

1.000E-05 

Orion 

1.000E-05 

Propulsion 

Elements 

2.500E-06 

MMOD 

All Elements 

1.000E-05 

Health 

Per Person 
Per Day on Orbit 

9.720E-05 

Departure 

Bum 

For each MTV 

1.200E-02 


Running the Model 

The simulation ends when either there has been a loss of 
mission event or the trans-Mars injection has occurred. 
1 ,000 replications of the simulation are executed to obtain 
a large data set to analyze. At the end of each replication, 
the model writes results in an Excel output file. In 
addition to writing the results to the output file, the 
deterministic inputs and assumptions that were used 
during the experiment are also written to the output file. 
An example of the dashboard that the analyst sees is 
shown in Figure 6. The upper two-thirds of the dashboard 
presents the launch and assembly sequence that the 
simulation attempts to execute in each of the 1,000 
replications. The experimental results are shown in the 
bottom third. 

The ground processing assumptions are identified in the 
far left column cells. The next two columns identify the 
MTV payload element being launched along with its 
respective system failure risk and MMOD risk while 
loitering in LEO during the assembly campaign. The 
Gantt chart in the middle of the figure shows the various 
launch vehicle stacking, payload integration, and pad flow 
operations. Note that there is a color code above the Gantt 
chart (white for transportation and offline processing, blue 
for launch vehicle stacking, red for payload integration 
and so on). Also the flow of the launches is from bottom 
to top and from left to right such that the Earth departure 
window for Mars, shown in magenta, is shown in the 
upper right comer of the Gantt chart. 


9 




Figure 6 - Model Output Dash Board Example 
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Green bars indicate available schedule margin (buffers). In 
this example there is a 500 day buffer between the last cargo 
launch and start of launch vehicle stacking for the Orion 
launch. There is a 30-day buffer between the Orion planned 
launch date and the opening of the departure window. 

To the right of the Gantt chart are cells that identify the 
various launch flows by name along with planned time 
between launch dates and maximum days on orbit for each 
of the MTV payload elements. 

The major risk model probabilities used in the simulation 
are identified along the bottom rows of the dashboard. 
Additionally, in the bottom left corner are a couple of cells 
that identify whether or not this analysis included the option 
for spare launches, and if so how many spares were 
available. 

The bottom third of the dashboard displays the simulation 
results that correspond to the scenario described above. The 
chart on the left indicates the probability for how many of 
the 1,000 replications successfully completed the trans-Mars 
injection burn. This is the metric to be maximized. 

The pie chart on the far right side identifies the number and 
proportion of failures for each of the major LOM categories: 
launch campaign failing to launch all launches; ascent 
failures; upper stage failures; AR&D failures; payload 
system failures; MMOD; failure of the SLS launching Orion 
resulting in an Orion ascent abort mode; Orion Rendezvous 
and dock failures, medical LOM events; and trans- 
destination injection (TDI) bum failures. 

The pie chart in the middle identifies the launches that were 
late and caused a late-launch LOM. The table to the left of 
this pie chart provides the probability of not launching for 
each of the launches in the campaign. 

The bottom row of the dashboard identifies the Arena model 
file name, the Excel file that is associated with that model, 
and the worksheet where the experiment results reside. 

5. Description of Cases Analyzed 

Eight unique cases were explored representing the 2 MTV 
propulsion types, the 2 MTV deployment strategies and the 
2 SLS cargo variants, as shown in Table 5. For each of these 
cases, the trade space also included Ground Architecture 


capacity drivers (single string vs. dual string facilities and 
5x2 vs. 5x3 processing) and number of spares (0, 1 or 2). In 
addition, cargo campaign buffer durations were varied to 
determine an optimum buffer size. Optimum buffer sizes 
were used in the analysis for each case and shown in the 
results. 

Each case in the trade space was analyzed with the model 
containing the risk factor settings previously described. 


Table 5. Trade Space 


Case 

# 

MTV 

Prop. 

Type 

MTV 

Deploy 

Strategy 

Number 

of 

Launches 

Cargo 

SLS 

Version 

Ground 

Architecture 

Spares 

1 

Chem 

All Up 

13 

105 1 




2 

12 

130 1 

Single 

String 



3 

NTR 

All Up 

11 

105 1 

5x2 


4 

10 

130 1 


0, 1,2 

5 

Chem 

Pre- 

8 and 5 

105 1 

Dual 

String 


6 

Deploy 

6 and 5 

130 1 

5x3 


7 

NTR 

Pre- 

6 and 4 

105 1 



8 

Deploy 

5 and 4 

130 1 





6. Results 

The summary level results are shown in Figures 7 & 8. 
Figure 7 displays the results for the 8 cases with single 
string, 5x2 processing assumptions. Figure 8 displays the 
results for the 8 cases with dual string, 5x3 processing 
assumptions. For both figures, the number of spares is 
varied from 0, 1 and 2. The 0 spares case is the bottom point 
in the column, the 1 spare is the middle point in the column 
and the 2 spares is the top point in the column. 

The pre-deploy cases consist of two launch and assembly 
campaigns. The first campaign launches and assembles 
MTV-1 and MTV-2, which are sent on their way to Mars 26 
months prior to the crew being sent. The second campaign 
launches and assembles MTV-3, which has the crew being 
launched last and as close as practical to the opening of the 
departure window so as to minimize crew time on orbit. 
This operational concept has significant implications for the 
launch and assembly campaigns. 

Detailed results for each of the 8 cases are shown in the 
Appendix. 
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Figure 7 - Launch and Assembly Reliability for Single String, 5x2 Processing 

Dual String, 5X3 Processing 
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Figure 8 - Launch and Assembly Reliability for Dual String, 5x3 Processing 
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The results of this analysis indicate several trends in launch 

and assembly reliability: 

• The cases in which cargo is pre-deployed to Mars at an 
opportunity prior to crew departure provide significantly 
improved reliability over the all-up cases. Allowing the 
two cargo MTVs to be launched and assembled for a prior 
opportunity effectively isolates those activities from those 
required to send the crew. This limits the total number of 
launches and elements to be assembled prior to each 
departure window, lessening the overall probability of 
failure. It is important to keep in mind that the improved 
launch and assembly reliability for the pre-deployed cases 
may be offset by the added duration that the pre-deployed 
assets have to wait at Mars for the crew to arrive. This 
potential offset should be assessed in the future as part of 
a total mission risk assessment process. 

• In most cases the 130 t launch vehicle provides for a 
higher launch and assembly reliability than the 105 t. This 
is due to the lower number of launches required to place 
the elements in LEO for the larger launch vehicle. 
However, these benefits are largely offset by the decrease 
in launch reliability for the larger capacity launch vehicle, 
associated with the liquid boosters and upper stage. 

• Having a dual-string ground processing and launch 
architecture also provides benefit over a single string 
capability. The dual-string capability lowers the required 
time between launches and helps limit propagating delays. 
The benefits of the dual-string capability are more 
pronounced in the all-up cases and for the chemical 
propulsion cases, where there is greatest total number of 
launches per opportunity. 

• Nuclear Thermal Propulsion for the MTVs results in 
greater launch and assembly reliability across the board, 
as compared to the equivalent chemical propulsion cases. 
This is due to the lower number of total required launches 
for each MTV. It should be noted though that this analysis 
does not consider any additional risks that might be 
incurred through the use of NTR. 

• The most significant improvements in launch and 
assembly reliability were associated with the availability 
of spare launch vehicles and elements to be used in the 
event of a launch or assembly failure. The addition of 
spare hardware to a campaign generally increased overall 
reliability from values that averaged approximately 0.5 
across all cases to average values of 0.75 and 0.80, for the 
one and two spares cases, respectively. The sparing 
strategy that was modeled assumed that the spare launch 
vehicle and payload element could be used to replace any 
failed payload element. While the launch vehicles are 
essentially interchangeable, the same cannot be said about 
the payload elements. Consequently, in order to realize 
all of the reliability improvement, each payload element 
would need to have a ready spare. 


the agency to identify and improve parameters that will 
most directly contribute to improved reliability. The 
simulation model allows for sensitivity analysis of any 
parameter. Cases involving varying crew parameters where 
selected to illustrate this capability. 

The launch campaigns ending with a crewed Orion launch 
have low reliability relative to the cargo only campaigns. 
The primary reasons lowering the reliability are related to 
crew health risks and launching the crew in close proximity 
to the departure window without backup should the launch 
fail to deliver the crew to their MTV. Sensitivity analysis is 
used to understand how to increase the launch and assembly 
campaign reliability. 

For the sensitivity analysis, Case 8 (Nuclear MTV 
Propulsion, Pre-Deployment of MTVs 1&2, and the 130 t 
SLS) - Scenario 6 (dual string ground architecture with 5x3 
processing and 2 spares) was selected. This Case-Scenario 
combination had a success probability of approximately 
0.847 as shown in Figure 8. The results were analyzed for 
sensitivity to: (1) launching the crew earlier; (2) an alternate 
value for the crew health risk factor; (3) reducing the crew 
size; and (4) having a backup crew and launch vehicle. 

The results for the 4 additional scenarios are displayed in 
Figure 9. The results for each scenario are presented using a 
consistent format showing the launch campaign success 
probability 95% confidence interval, along with the 
midpoint of that interval. The table at the bottom of the 
figure highlights in yellow key model parameters that were 
changed relative to the initial settings for Scenario 6. 

In Scenario 7, the constraint that the planned launch of the 
crew be held at a constant date relative to the opening of the 
Earth orbit departure window was relaxed. In all the 
scenarios analyzed previously the planned crew launch date 
provided 30 days of schedule margin for launch delays. As 
it turned out, a value of 30-days was very close to optimum. 
A very modest improvement was found by adding an 
additional 5 days of margin (from 30 days to 35 days). 

In Scenario 8, the crew health risk value was changed to 
7.2E-05 for the risk of loss of mission per crew member per 
day on orbit. This value represented the most optimistic 
value received from the medical community described 
earlier. The simulation results show a very modest 
improvement. 


Sensitivity Analysis 

A major goal in the development of the launch and 
assembly reliability analysis was to enable sensitivity 
analysis for critical parameters. Sensitivity analysis allows 
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Figure 9 - Sensitivity Analysis for Case 8 
(Pre-Deploy, NTR, 130 t SLS) 

In Scenario 9, the crew size was reduced from 6 to 4 to see 
how much improvement in reliability could be achieved by 
reducing risk of a loss of mission due to a medical event. 
Reducing the crew size, coupled with the improved crew 
health risk value, provided a modest improvement. Note that 
the optimum crew buffer size was found to be 45 days. 
However, the projected campaign success probability 
probably needs to be higher. Note that reducing the crew 
size would also reduce launch mass and potentially the 
number of launches required. These potential benefits were 
not analyzed, but should be considered in the future when 
trading crew size. 


Finally, in Scenario 10, the launch campaign was rearranged 
so that the second of the two available spare launches is held 
on the ground until after the crew launches. In this way, the 
final spare vehicle is available to be launched in support of a 
failed crew mission or any of the other payload elements 
that have been previously placed on orbit should they have 
failed. The concept would require that the launch vehicle be 
ready for integration when a launch or on-orbit failure 
occurs and requires rapid integration with either a payload 
element or a crew vehicle. Alternatively, one could have a 
third spare launch vehicle pre-configured for a crewed 
launch. 


The optimum value for the crew launch buffer was 
determined to be 60 days. Additionally, the optimum buffer 
for the cargo launches prior to the crew launch was found to 
be 200 days. Scenario 10 provides a significant benefit and 
places the projected campaign success probability at 
approximately 0.94. 

Having a backup launch to support a crewed launch is not 
without precedent. For the last space shuttle servicing 
mission to the Hubble Space Telescope, a second space 
shuttle was on an alternate launch pad ready to launch in 
case the launched mission suffered damage to its thermal 
protection system such that the crew needed to be rescued 
[19]. 


7. Conclusions and Forward Work 

A capability to perform integrated launch and assembly 
campaign reliability risk for human exploration of Mars has 
been established. 

Initial findings indicate a significant relationship between 
the risk factor settings and mission success. Consequently, it 
will be important going forward to obtain an accurate 
estimate for the Space Launch System’s ascent reliability, 
the reliability of the planned rendezvous and docking 
systems, the reliability and MMOD resilience of the mission 
elements once they have been placed in orbit by the SLS, 
and the crew health risks. Understanding the investment 
required to achieve reliability improvements and crew 
health risk mitigation will also be key to making informed 
trades. 

A significant finding is that having spare launches (along 
with spare payload elements) seems to be key to the 
viability of any launch and assembly campaign regardless of 
the concept of operations parameters - MTV propulsion 
type, MTV deployment strategy, SLS capacity, or ground 
architecture assumptions. 

Forward work includes updates to risk factors and adding 
additional constraints as they emerge from the NASA 
programs designing, building and operating the systems that 
will be required for human exploration of Mars. 
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Appendix 

The detailed results for each case are presented using a 
consistent format showing the launch campaign success 
probability 95% confidence interval, along with the 
midpoint of that interval. For each case, results are shown 
for the 6 different scenarios that we explored. Scenarios 1 -3 
are with the single-string ground architecture and 5x2 
processing. Scenarios 4-6 have the dual-string ground 
architecture with 5x3 processing. Scenarios 1 and 4 
represent the maximum success probability that could be 
achieved without adding spares into the launch campaign. 
Scenarios 2 and 5 are based upon campaigns having 1 spare 
and Scenarios 3 and 6 are based upon launch campaigns 
having 2 spares. 
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The All-Up cases (Cases 1 -4) are presented first followed by 
the Pre-Deploy cases (Cases 5-8). In order to determine the 
success probabilities for the Pre-Deploy cases, the cases are 
split into the pre-deployment campaigns for MTV-1 & 2 
and the MTV-3 campaign (crew launch). The results for the 
MTV-1 & 2 campaign were then combined with the MTV-3 
campaigns to obtain the combined campaign reliability for 
Cases 5-8 that were shown in Figure 7 and Figure 8. 

One thing to note is the wide range in duration of the launch 
and assembly campaign as shown in the tables below each 
of the results figures. 
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Detailed Results for All-Up Cases 
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Figure 10 - Case 1 Summary Results 
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Figure 12 - Case 3 Summary Results 
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Figure 11 - Case 2 Summary Results 


Figure 13 - Case 4 Summary Results 
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Detailed Results for Pre-Deployment of MTVs 1&2 


MTVs-l&2 Campaign Success Probability 

(Chemical, Pre-Deploy MTVs 1 &2, 1 05 1 SLS) 0.974 

0.9 *- 0.913 * ° 9 — + 0.923 I 

0.8 

0.7 ^ 0.686 "I" °' 724 

0.6 

0.5 

0.4 

0.3 

0.2 

0.1 

0.0 


1 2 3 4 5 6 

Scenario 


Scenario Number 

1 

2 

3 

4 

5 

6 

Spares 

0 

1 

2 

0 

1 

2 

Ground Arch. 

Single String 

Dual String 

Processing 

5x2 

5x3 

Buffer (days) 

400 

400 

400 

240 

240 

240 

Launch Campaign 
Duration (days) 

1,268 

1,392 

1,515 

504 

565 

587 


Figure 14 - Summary Results for Case 5 (Pre-Deploy, 
Chemical, 105 t SLS) Pre-Deployment of MTVs 1&2 



Figure 15 - Summary Results for Case 6 (Pre-Deploy, 
Chemical, 130 t SLS) Pre-Deployment of MTVs 1&2 


MTVs-l&2 Campaign Success Probability 

(Nuclear, Pre-Deploy MTVs 1 &2, 1 05 1 SLS) 0.980 

L ° 0.954 °- 974 t 0.959 " P 

0.9 

0,8 — f 0.760 + 0 ' 789 

0.7 

0.6 

0.5 

0.4 

0.3 

0.2 

0.1 

0.0 


Scenario 


Scenario Number 

1 

2 

3 

4 

5 

6 

Spares 

0 

1 

2 

0 

1 

2 

Ground Arch. 

Single String 

Dual String 

Processing 

5x2 

5x3 

Buffer (days) 

310 

400 

430 

230 

290 

290 

Launch Campaign 
Duration (days) 

931 

1,145 

1,298 

411 

532 

554 


Figure 16 - Summary Results for Case 7 (Pre-Deploy 
NTR, 105 t SLS) Pre-Deployment of MTVs 1&2 



Figure 17 - Summary Results for Case 8 (Pre-Deploy 
NTR, 130 t SLS) Pre-Deployment of MTVs 1&2 
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Detailed Results for MTV-3 Campaigns 
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Figure 18- Summary Results for Case 5 
(Pre-Deploy, Chemical, 105 t SLS) MTV-3 (Crew) 
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Figure 19- Summary Results for Case 6 
(Pre-Deploy, Chemical, 130 t SLS) MTV-3 (Crew) 
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Figure 20 - Summary Results for Case 7 
(Pre-Deploy, NTR, 105 t SLS) MTV-3 (Crew) 
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Figure 21- Summary Results for Case 8 
(Pre-Deploy, NTR, 130 t SLS) MTV-3 (Crew) 
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Detailed Results for Combined Pre-deployment of MTVs 1&2 and MTV 3 
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Figure 22 - Summary Results for Case 5 
(Pre-Deploy, Chemical, 105 t SLS) 
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Figure 24- Summary Results for Case 7 
(Pre-Deploy, NTR, 105 t SLS) 
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Figure 23- Summary Results for Case 6 
(Pre-Deploy, Chemical, 130 t SLS) 
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Figure 25- Summary Results for Case 8 
(Pre-Deploy, NTR, 130 t SLS) 
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